diff options
author | Sascha Hauer <s.hauer@pengutronix.de> | 2023-03-15 10:53:00 +0100 |
---|---|---|
committer | Sascha Hauer <s.hauer@pengutronix.de> | 2023-03-15 10:55:26 +0100 |
commit | 7830dc62c88e890ae8e5324793bbec407334626f (patch) | |
tree | e0776d4c8c34bc3afc960eec656d83588c84cb8f /fs | |
parent | 7fe4fd063eed20d6d7f502d23f32b880b8589159 (diff) | |
download | barebox-7830dc62c88e890ae8e5324793bbec407334626f.tar.gz |
fs: tftp: Fix NULL pointer deref in file upload
With TFTP upload the window cache is unused, but still freed in
tftp_do_close(). To avoid iterating on the uninitialized list,
initialize it unconditionally and not only for the download case.
Fixes: 3f1ea0ffcf8b ("tftp: implement UDP reorder cache using lists")
Link: https://lore.barebox.org/20230315095300.2914980-1-s.hauer@pengutronix.de
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
Diffstat (limited to 'fs')
-rw-r--r-- | fs/tftp.c | 4 |
1 files changed, 2 insertions, 2 deletions
@@ -384,10 +384,10 @@ static int tftp_allocate_transfer(struct file_priv *priv) priv->fifo = NULL; goto err; } - } else { - INIT_LIST_HEAD(&priv->cache.blocks); } + INIT_LIST_HEAD(&priv->cache.blocks); + return 0; err: |